DIGITAL media protection has become an important issue

Transcription

1 1 Fingerprinting with Equiangular Tight Frames Dustin G. Mixon, Christopher J. Quinn, Student Member, IEEE, Negar Kiyavash, Member, IEEE, and Matthew Fickus, Member, IEEE Abstract Digital fingerprinting is a framework for marking media files, such as images, music, or movies, with user-specific signatures to deter illegal distribution. Multiple users can collude to produce a forgery that can potentially overcome a fingerprinting system. This paper proposes an equiangular tight frame fingerprint design which is robust to such collusion attacks. We motivate this design by considering digital fingerprinting in terms of compressed sensing. The attack is modeled as linear averaging of multiple marked copies before adding a Gaussian noise vector. The content owner can then determine guilt by exploiting correlation between each user s fingerprint and the forged copy. The worst-case error probability of this detection scheme is analyzed and bounded. Simulation results demonstrate the average-case performance is similar to the performance of orthogonal and simplex fingerprint designs, while accommodating several times as many users. Index Terms digital fingerprinting, collusion attacks, frames. I. INTRODUCTION DIGITAL media protection has become an important issue in recent years, as illegal distribution of licensed material has become increasingly prevalent. A number of methods have been proposed to restrict illegal distribution of media and ensure only licensed users are able to access it. One method involves cryptographic techniques, which encrypt the media before distribution. By doing this, only the users with appropriate licensed hardware or software have access; satellite TV and DVDs are two such examples. Unfortunately, cryptographic approaches are limited in that once the content is decrypted (legally or illegally), it can potentially be copied and distributed freely. D. G. Mixon is with the Department of Mathematics and Statistics, Air Force Institute of Technology, Wright-Patterson AFB, Ohio USA ( dustin.mixon@afit.edu). C. J. Quinn is with the Department of Electrical and Computer Engineering, University of Illinois, Urbana, Illinois USA ( quinn7@illinois.edu). N. Kiyavash is with the Department of Industrial and Enterprise Systems Engineering, University of Illinois, Urbana, Illinois USA ( kiyavash@illinois.edu). M. Fickus is with the Department of Mathematics and Statistics, Air Force Institute of Technology, Wright-Patterson AFB, Ohio USA ( matthew.fickus@afit.edu). This work was presented in part at ICASSP 011 and SPIE 011. The authors thank the Air Force Summer Faculty Fellowship Program for making this collaboration possible. This work was supported by NSF DMS , AFOSR F1ATA00083G004, AFOSR F1ATA00183G003, AFOSR FA and NRL N G033. Mixon was supported by the A. B. Krongard Fellowship. Quinn was supported by the Department of Energy Computational Science Graduate Fellowship, which is provided under grant number DE-FG0-97ER5308. The views expressed in this article are those of the authors and do not reflect the official policy or position of the United States Air Force, Department of Defense, or the U.S. Government. Copyright (c) 01 IEEE. Personal use of this material is permitted. However, permission to use this material for any other purposes must be obtained from the IEEE by sending a request to pubs-permissions@ieee.org. An alternate approach involves marking each copy of the media with a unique signature. The signature could be a change in the bit sequence of the digital file or some noise-like distortion of the media. The unique signatures are called fingerprints, by analogy to the uniqueness of human fingerprints. With this approach, a licensed user could illegally distribute the file, only to be implicated by his fingerprint. The potential for prosecution acts as a deterrent to unauthorized distribution. Fingerprinting can be an effective technique for inhibiting individual licensed users from distributing their copies of the media. However, fingerprinting systems are vulnerable when multiple users form a collusion by combining their copies to create a forged copy. This attack can reduce and distort the colluders individual fingerprints, making identification of any particular user difficult. Some examples of potential attacks involve comparing the bit sequences of different copies, averaging copies in the signal space, as well as introducing distortion (such as noise, rotation, or cropping). There are two principal approaches to designing fingerprints with robustness to collusions. The first approach uses the marking assumption [1]: that the forged copy only differs from the colluders copies where the colluders copies are different (typically in the bit sequence). In many cases, this is a reasonable assumption because modifying other bits would likely render the file unusable (such as with software). Boneh and Shaw proposed the first known fingerprint design that uses the marking assumption to identify a member of the collusion with high probability [1]. Boneh and Shaw s method incorporates the results of Chor et al., who investigated how to detect users who illegally share keys for encrypted material []. Schaathun later showed that the Boneh-Shaw scheme is more efficient than initially thought and proposed further improvements [3]. Tardos also proposed a method with significantly shorter code lengths than those of the Boneh-Shaw procedure [4]. Several recent works investigate the relationship between the fingerprinting problem and multiple access channels, and they calculate the capacity of a fingerprint channel [5] [8]. Barg et al. also developed parent-identifying codes under a relaxation of the marking assumption [9], and there have been a number of other works developing special classes of binary fingerprinting codes, including [10] [15]. The second major approach uses the distortion assumption this is the assumption we will use. In this regime, fingerprints are noise-like distortions to the media in signal space. In order to preserve the overall quality of the media, limits are placed on the magnitude of this distortion. The content owner limits the power of the fingerprint he adds, and the collusion limits the power of the noise they add in their attack. When applying the distortion assumption,

2 the literature typically assumes that the collusion linearly averages their individual copies to forge the host signal. Also, while results in this domain tend to accommodate fewer users than those with the marking assumption, the distortion assumption enables a more natural embedding of the fingerprints, i.e., in the signal space. Cox et al. introduced one of the first robust fingerprint designs under the distortion assumption [16]; the robustness was later analytically proven in [17]. Ergun et al. then showed that for any fingerprinting system, there is a trade-off between the probabilities of successful detection and false positives imposed by a linear-average-plus-noise attack from sufficiently large collusions [18]. Specific fingerprint designs were later studied, including orthogonal fingerprints [19] and simplex fingerprints [0]. There are also some proposed methods motivated by CDMA techniques [1], []. Jourdas and Moulin demonstrated that a high rate can be achieved by embedding randomly concatenated, independent short codes [3]. Kiyavash and Moulin derived a lower bound on the worstcase error probabilities for designs with equal-energy fingerprints [4]. An error probability analysis of general fingerprint designs with unequal priors on user collusion is given in [5]. Some works have also investigated fingerprint performance under attack strategies other than linear averaging [6], [7] and under alternative noise models [8]. When working with distortion-type fingerprints, some embedding process is typically needed. This process is intended to make it difficult for the colluders to identify or distort fingerprints without significantly damaging the corresponding media in the process. For instance, if the identity basis is used as an orthogonal fingerprint design, then three or more colluders can easily identify and remove their fingerprints through comparisons. Indeed, different signal dimensions have different perceptual significance to the human user, and one should vary signal power strengths accordingly. There is a large body of work in this area known as watermarking, and this literature is relevant since fingerprinting assigns a distinct watermark to each user. As an example, one method of fingerprint embedding is known as spread spectrum watermarking. Inspired by spread spectrum communications [9], this technique rotates the fingerprint basis to be distributed across the perceptually significant dimensions of the signal [16]. This makes fingerprint removal difficult while at the same time maintaining acceptable fidelity. For an overview of watermarking media, see [30], [31]. The present paper proposes equiangular tight frames for fingerprint design under the distortion assumption. To be clear, a frame is a collection of vectors {f m } M m=1 R N with frame bounds 0 < A B < that satisfy A x M x,f m B x m=1 for every x R N. If each f m has unit norm, we say {f m } M m=1 forms a unit norm frame. In the special case where A = B, the collection is said to be a tight frame. This leads to the following definition: Definition 1. An equiangular tight frame (ETF) is a unit norm tight frame with the additional property that there exists a constant c such that for every pair m m. f m,f m = c In considering equiangular tight frames for fingerprint design, we analyze their performance against the worst-case collusion. Moreover, through simulations, we show that these fingerprints perform comparably to orthogonal and simplex fingerprints on average, while accommodating several times as many users. Li and Trappe [] also used fingerprints satisfying the Welch bound, but did not use tight frames, designed the decoder to return the whole collusion, and did not perform worst case analysis. Use of compressed sensing for fingerprint design was first suggested in [3] and [33], follow by [34]. However, [34] and [33] focused on detection schemes with Gaussian fingerprints. Additionally, [35] examined combinatorial similarities of fingerprint codes and compressed sensing measurement matrices. We present the description of the fingerprinting problem in Section II. In Section III, we discuss this problem from a compressed sensing viewpoint and introduce the equiangular tight frame fingerprint design. Using this design, we consider a detector which determines guilt for each user through binary hypothesis testing, using the correlation between the forged copy and the user s fingerprint as a test statistic. In Section IV, we derive bounds on the worst-case error probability for this detection scheme assuming a linear-average-plus-noise attack. Finally in Section V, we provide simulations that demonstrate the average-case performance in comparison to orthogonal and simplex fingerprint designs. II. PROBLEM SETUP In this section, we describe the fingerprinting problem and discuss the performance criteria we will use in this paper. We start with the model we use for the fingerprinting and attack processes. A. Mathematical model A content owner has a host signal that he wishes to share, but he wants to mark it with fingerprints before distributing. We view this host signal as a vector s R N, and the marked versions of this vector will be given to M > N users. Specifically, the mth user is given x m = s+f m, (1) where f m R N denotes the mth fingerprint. We assume the fingerprints have equal energy: γ := f m = ND f, () that is, D f denotes the average energy per dimension of each fingerprint. We wish to design the fingerprints {f m } M m=1 to be robust to a linear averaging attack. In particular, let K {1,...,M}

3 3 To determine the effectiveness of our fingerprint design and focused detector, we will investigate the corresponding error probabilities. Fig. 1. The fingerprint assignment (1) and forgery attack (3) processes. denote a group of users who together forge a copy of the host signal. Then their linear averaging attack is of the form y = α k (s+f k )+ǫ, α k = 1, (3) where ǫ is a noise vector introduced by the colluders. We assume ǫ is Gaussian noise with mean zero and variance N, that is, is the noise power per dimension. The relative strength of the attack noise is measured as the watermarkto-noise ratio (WNR): ( NDf ) WNR := 10log 10 N. (4) This is analogous to signal-to-noise ratio. See Figure 1 for a schematic of this attack model. B. Detection Certainly, the ultimate goal of the content owner is to detect every member in a forgery coalition. This can prove difficult in practice, though, particularly when some individuals contribute little to the forgery, with α k 1. However, in the real world, if at least one colluder is caught, then other members could be identified through the legal process. As such, we consider focused detection, where a test statistic is computed for each user, and we perform a binary hypothesis test for each user to decide whether that particular user is guilty. With the cooperation of the content owner, the host signal can be subtracted from a forgery to isolate the fingerprint combination: z := α k f k +ǫ. We refer to α kf k as the noiseless fingerprint combination. The test statistic for each user m is the normalized correlation function: T m (z) := 1 γ z,f m, (5) where γ is the fingerprint energy (). For each user m, let H 1 (m) denote the guilty hypothesis (m K) and H 0 (m) denote the innocent hypothesis (m K). Letting τ denote a correlation threshold, we use the following detector: { H1 (m), T δ m (τ) := m (z) τ, (6) H 0 (m), T m (z) < τ. C. Error analysis Due in part to the noise that the coalition introduced to the forgery, there could be errors associated with our detection method. One type of error we can expect is the false-positive error, whose probability is denoted P I, in which an innocent user m (m / K) is found guilty (T m (z) τ). This could have significant ramifications in legal proceedings, so this error probability should be kept extremely low. The other error type is the false-negative error, whose probability is denoted P II, in which a guilty user (m K) is found innocent (T m (z) < τ). The probabilities of these two errors depend on the fingerprints F = {f m } M m=1, the coalition K, the weights α = {α k }, the user m, and the threshold τ: P I (F,m,τ,K,α) := Prob[T m (z) τ H 0 (m)], P II (F,m,τ,K,α) := Prob[T m (z) < τ H 1 (m)]. We will characterize the worst-case error probabilities over all possible coalitions and users. We first define the probability of a false alarm : P fa (F,τ,K,α) := max m K P I(F,m,τ,K,α). (7) This is the probability of wrongly accusing the innocent user who looks most guilty. Equivalently, this is the probability of accusing at least one innocent user. The worst-case type I error probability is given by P I (F,τ,α) := max K P fa(f,τ,k,α). (8) Next, consider the probability of a miss : P m (F,τ,K,α) := min m K P II(F,m,τ,K,α). This is the probability of not accusing the most vulnerable guilty user. Equivalently, this is the probability of not detecting any colluders. Note that this event is the opposite of detecting at least one colluder: P d (F,τ,K,α) := 1 P m (F,τ,K,α). (9) The worst-case type II error probability is given by P II (F,τ,α) := max K P m(f,τ,k,α). (10) The worst-case error probability is the maximum of the two error probabilities (8) and (10): P e (F,τ,α) := max { P I (F,τ,α),P II (F,τ,α) }. The threshold parameter τ can be varied to minimize this quantity, yielding the minmax error probability: P minmax (F,α) := min τ P e (F,τ,α). (11) In Section IV, we will analyze these error probabilities. We will also investigate average-case performance using simulations in Section V.

4 4 III. ETF FINGERPRINT DESIGN In this section, we introduce a fingerprint design based on equiangular tight frames (ETFs). Before we discuss the design, we first motivate it in terms of a certain geometric figure of merit that originated in [0] to evaluate simplex fingerprints. A. Geometric figure of merit For each user m, consider the distance between two types of potential collusions: those of which m is a member, and those of which m is not. Intuitively, if every noiseless fingerprint combination involving m is distant from every fingerprint combination not involving m, then even with moderate noise, there should be little ambiguity as to whether the mth user was involved or not. To make this precise, for each userm, we define the guilty and not guilty sets of noiseless fingerprint combinations: G (K) m := { 1 G m (K) := K { 1 f k : m K {1,...,M}, K K K f k : m K {1,...,M}, K K In words, G m (K) of equal weights (α k = 1 K }, }. is the set of size-k fingerprint combinations ) which include m, while G(K) m is the set of combinations which do not include m. Note that in our setup (3), the α k s were arbitrary nonnegative values bounded by one. We will show in Section IV that the best attack from the collusion s perspective uses equal weights (α k = 1 K ) so that no single colluder is particularly vulnerable. For this reason, we use equal weights to obtain bounds on the distance between these two sets, which we define to be dist(g (K) m, G (K) m ) := min{ x y : x G (K) m,y G (K) m }. (1) In this section, we will find a lower bound on this distance by exploiting specially designed properties of the fingerprints. B. Applying the restricted isometry property In this subsection, we introduce some ideas from the compressed sensing literature. To motivate our use of these ideas, we take a brief detour from our goal of focused detection. For the moment, suppose we wish to identify the entire collusion, as opposed to just one member of the collusion. To do this, we consider a matrix-vector formulation of the attack (3) without noise, i.e., with ǫ = 0. Specifically, let F denote the N M matrix whose columns are the fingerprints {f m } M m=1, and let the M 1 vector α denote the weights used in the collusion s linear average. Note that α m is zero if user m is innocent, otherwise it s given by the corresponding coefficient in (3). This gives z = Fα. Using this representation, the detection problem can be interpreted from a compressed sensing perspective. Namely, α is a K-sparse vector that we wish to recover. Under certain conditions on the matrix F, we may sense this vector with N < M measurements in such a way that the K-sparse vector is recoverable; this is the main idea behind compressed sensing. In particular, the vector is recoverable when the matrix satisfies the following matrix property: Definition. We say an N M matrix F satisfies the restricted isometry property (RIP) if there exists a constant δ K < 1 such that (1 δ K ) α Fα (1+δ K ) α (13) for every K-sparse vector α R M. The restricted isometry property was introduced in [36] to recover sparse vectors using linear programming. Since then, RIP has proven to be particularly ubiquitous across compressed sensing, enabling reconstruction guarantees for a variety of alternatives to linear programming, e.g. [37], [38]. Thus, if F satisfies RIP (13), we can recover the K-sparse vector α R M using any of these techniques. In fact, for the attack model with adversarial noise, z = Fα+ǫ, if F satisfies RIP (13), linear programming will still produce an estimate ˆα of the sparse vector [39]. However, the distance between ˆα and α will be on the order of 10 times the size of the error ǫ. Due to potential legal ramifications of false accusations, this order of error is not tolerable. This is precisely the reason we prefer focused detection (6) over identifying the entire collusion. Regardless, we can evaluate fingerprints with the restricted isometry property in terms of our geometric figure of merit. Without loss of generality, we assume the fingerprints are unit norm; since they have equal energy γ, the fingerprint combination z can be normalized by γ before the detection phase. With this in mind, we have the following a lower bound on the distance (1) between the guilty and not guilty sets corresponding to any user m: Theorem 3. Suppose fingerprints F = [f 1,...,f M ] satisfy the restricted isometry property (13). Then dist(g m (K), G m (K) 1 δ K ) K(K 1). (14) Proof: Take K,K {1,...,M} such that K, K K and m K\K. Then the left-hand inequality of the restricted isometry property (13) gives 1 f k 1 K K f k ( = 1 K ) 1 K f k + 1 K f k 1 K f k K ( (1 δ K K ) = 1 δ K K K K \K K K ( 1 K 1 K ( K + K K K \K ) + K\K K ) ) + K \K K. (15) For a fixed K, we will find a lower bound for ( ) 1 K K + K K K = 1+ K K K K. (16)

5 5 Since we can have K K > K, we know K K K K < 0 when (16) is minimized. That said, K must be as small as possible, that is, K = K K. Thus, when (16) is minimized, we must have 1 K ( K + K K K ) = K K K 1, i.e., K K must be as large as possible. Since m K\K, we have K K K 1. Therefore, ( ) 1 K K + K K K 1 K 1. (17) Substituting (17) into (15) gives 1 K f k 1 K 1 δ K K K ( K 1) 1 δ K K(K 1). f k Since this bound holds for everym,kandk withm K\K, we have (14). Note that (14) depends onδ K, and so it s natural to ask how small δ K can be for a given fingerprint design. Also, which matrices even satisfy RIP (13)? Unfortunately, certifying RIP is NP-hard in general [40], [41], but when K is sufficiently small, RIP can be demonstrated in terms of a certain coherence parameter. Specifically, the worst-case coherence is the largest inner product between any two distinct fingerprints: µ := max i j f i,f j. (18) Intuitively, we want this value to be small, as this would correspond to having the fingerprints spaced apart. In fact, the Gershgorin circle theorem can be used to produce the following well-known bound on δ K in terms of worst-case coherence (see [4] for details): Lemma 4. Given a matrix F with unit-norm columns, then δ K (K 1)µ, (19) where µ is the worst-case coherence (18). Combining Theorem 3 and Lemma 4 yields a coherencebased lower bound on the distance between the guilty and not guilty sets corresponding to any user m: Theorem 5. Suppose fingerprints F = [f 1,...,f M ] are unitnorm with worst-case coherence µ. Then dist(g m (K), G m (K) 1 (K 1)µ ). (0) K(K 1) We would like µ to be small, so that the lower bound (0) is as large as possible. But for a fixed N and M, the worstcase coherence of unit-norm fingerprints cannot be arbitrarily small; it necessarily satisfies the Welch bound [43]: µ M N N(M 1). Equality in the Welch bound occurs precisely in the case where the fingerprints form an equiangular tight frame [44]. One type of ETF has already been proposed for fingerprint design: the simplex [0]. The simplex is an ETF with M = N + 1 and µ = 1 N. In fact, [0] gives a derivation for the value of the distance (1) in this case: dist(g (K) m, G (K) m ) = 1 M K(K 1) M 1. (1) The bound (0) is lower than (1) by a factor of 1 K N+1, and for practical cases in which K N, they are particularly close. Overall, ETF fingerprint design is a natural generalization of the provably optimal simplex design of [0]. C. The sufficiency of deterministic ETFs Theorem 3 gives that RIP fingerprints suffice to separate the guilty and not guilty sets for every user m. Intuitively, this allows law enforcement to deliver sound accusations, provided the noise used by the collusion is sufficiently small. As such, we naturally seek RIP matrices. To this end, random matrices are particularly successful: For any δ K, there exists a constant C such that ifn CKlog(M/K), then matrices of Gaussian or Bernoulli (±1) entries satisfy RIP with high probability. However, as mentioned in the previous section, checking if a given matrix satisfies RIP is computationally difficult [40], [41]; there is no known efficient procedure to verify that a randomly generated matrix satisfies RIP for the large values of K that probabilistic constructions provide. Fortunately, there are some deterministic constructions of RIP matrices, such as [45], [46]. However, the performance, measured by how large K can be, is not as good as the random constructions; the random constructions only require N = Ω(Klog a M), while the deterministic constructions require N = Ω(K ). The specific class of ETFs additionally requires M N [44]. Whether N scales as K versus K is an important distinction between random and deterministic RIP matrices in the compressed sensing community [47], since users seek to minimize the number N of measurements needed to sense K-sparse signals. However, this difference in scaling offers no advantage for fingerprinting. Indeed, Ergun et al. showed that for any fingerprinting system, a collusion of size K = O( N/logN) is sufficient to overcome the fingerprints [18]. This means with such a K, the detector cannot, with high probability, identify any attacker without incurring a significant false-alarm probability P fa (7). This constraint is more restrictive than deterministic ETF constructions, as N/logN < N N/log a M. In this way, it appears that random fingerprints are not necessary, as they offer no apparent advantage over deterministic ETF constructions. In fact, Section V illustrates that deterministic ETFs tend to perform slightly better than random fingerprints. This marks a significant difference between compressed sensing and the fingerprinting problem. Ergun s bound indicates that with a large enough K, colluders can overcome any fingerprinting system and render our detector unreliable. As an aside, the following lemma shows that if K is sufficiently large, the colluders can exactly recover the original signal s:

6 6 F = 1 3 Fig.. The equiangular tight frame constructed in Example Lemma 6. Suppose the real equal-norm fingerprints {f k } do not lie in a common hyperplane. Then s is the unique minimizer of g(x) := ( x (s+f k ) 1 ) x (s+f k ). K k K Proof: Note that g(x) 0, with equality precisely when x (s+f k ) is constant over k K. Since the f k s have equal norm, g(s) = 0. To show that this minimum is unique, suppose g(x) = 0 for some x s. This implies that the values x (s+f k ) are constant, with each being equal to their average. Moreover, since x (s+f k ) = x s x s,f k + f k, we have that x s,f k is constant over k K, contradicting the assumption that the fingerprints {f k } do not lie in a common hyperplane. D. Construction of ETFs Having established that deterministic RIP constructions are sufficient for fingerprint design, we now consider a particular method for constructing ETFs. Note that Definition 1 can be restated as follows: An ETF is an N M matrix which has orthogonal rows of equal norm and unit-norm columns whose inner products have equal magnitude. This combination of row and column conditions makes ETFs notoriously difficult to construct in general, but a relatively simple approach was recently introduced in [46]. The approach uses a tensor-like combination of a Steiner system s adjacency matrix and a regular simplex, and it is general enough to construct infinite families of ETFs. We illustrate the construction with an example: Example 1 (see [46]). To construct an ETF, we will use a simple class of Steiner systems, namely (,, v)-steiner systems, and Hadamard matrices with v rows. In particular, (,,v)-steiner systems can be thought of as all possible pairs of a v-element set [48], while a Hadamard matrix is a square matrix of ±1 s with orthogonal rows [48]. In this example, we take v = 4. The adjacency matrix of the (,,4)-Steiner system has ( 4 ) = 6 rows, each indicating a distinct pair from a size-4 set: A = () To be clear, we use +/ to represent ±1 and an empty space to represent a 0 value. Also, one example of a 4 4 Hadamard matrix is H = (3) + + We now build an ETF by replacing each of the + entries in the adjacency matrix () with a row from the Hadamard matrix (3). This is done in such a way that for each column of A, distinct rows of H are used; in this example, we use the second, third, and fourth rows of H. After performing this procedure, we normalize the columns, and the result is a real ETF F of dimension N = 6 with M = 16 fingerprints (see Figure ). We will use this method of ETF construction for simulations in Section V. Specifically, our simulations will let the total number of fingerprints M range from N to 7N, a significant increase from the conventional N + 1 simplex and N orthogonal fingerprints. Note, however, that unlike simplex and orthogonal fingerprints, there are limitations to the dimensions that admit real ETFs. For instance, the size of a Hadamard matrix is necessarily a multiple of 4, and the existence of Steiner systems is rather sporadic. Fortunately, identifying Steiner systems is an active area of research, with multiple infinite families already characterized and alternative construction methods developed [46], [49]. Also, it is important to note that the sporadic existence of ETFs will not help colluders determine the fingerprint marking, since the same random factors used in conventional orthogonal and simplex fingerprints can also be employed with ETFs in general. For example, we can randomly orient our ETF fingerprints F by randomly drawing an N N orthogonal matrix Q and using the columns of QF as fingerprints; note that QF is still an ETF by Definition 1, but these new fingerprints enjoy some degree of randomness. IV. ERROR ANALYSIS A. Analysis of type I and type II errors We now investigate the worst case errors involved with using ETF fingerprint design and focused correlation detection under linear averaging attacks. Recall that the worst-case type I error probability (8) is the probability of falsely accusing the most guilty-looking innocent user. Also recall that the worstcase type II error probability (10) is the probability of not accusing the most vulnerable guilty user.

7 7 Theorem 7. Suppose the fingerprints F = {f m } M m=1 form an equiangular tight frame. Then the worst-case type I and type II error probabilities, (8) and (10), satisfy [ γ ( ) ] P I (F,τ,α) Q τ µ, [ γ ( ((1+µ)max P II (F,τ,α) Q α k µ ) ) ] τ, where Q(x) := 1 π x e u / du and µ = M N N(M 1). Proof: Under hypothesis H 0 (m), the test statistic for the detector (6) is T z (m) = 1 γ α n f n +ǫ,f m n K = n Kα n (±µ)+ǫ, where ǫ is the projection of noise ǫ/γ onto the normed vector f m /γ, and, due to symmetry of the variance of ǫ in all dimensions, ǫ N(0, /γ ). Thus, under hypothesis H 0 (m), T z (m) N( n K α n(±µ), /γ ). We can subtract the mean and divide by the standard deviation to obtain: Prob[T m (z) τ H 0 (m)] = Q ( γ [ ( )]) τ α n (±µ) n K Q( γ (τ µ)). (4) Note that Q(x) is a decreasing function. The bound (4) is obtained by setting all of the coefficients of the coherence to be positive. Likewise, under hypothesis H 1 (m), the test statistic is T z (m) = 1 γ α n f n +ǫ,f m n K = α m + n K\{m} α n (±µ)+ǫ. Thus, under hypothesis H 1 (m), T z (m) N α m + α n (±µ),. n K\{m} Since 1 Q(x) = Q( x), the type II error probability can be bounded as Prob[T m (z) < τ] = Q γ τ α m + α n (±µ) n K\{m} γ ) Q( ([α m(1+µ) µ] τ). We can now evaluate the worst-case errors (8) and (10). For type I errors, with m / K: γ P I (F,τ,α) = max K max m K P I(F,m,τ,K,α) = max K max m K Prob[T m(z) τ H 0 (m)] max maxq(γ (τ µ)). K m K = Q( γ (τ µ)). For type II errors, P II (F,τ,α) = max min P II(F,m,τ,K,α) K m K = max min Prob[T m(z) < τ] K m K max K min m K Q(γ ([α m(1+µ) µ] τ)) = Q( γ ([max m K α m(1+µ) µ] τ)). The last equation follows since once the α s are fixed, the actual coalition K does not matter. We can further maximize over all possible weightings α: P I (F,τ) = max α P I(F,τ,α) Q( γ (τ µ)) P II (F,τ)= max P II(F,τ,α) α max α Q(γ ([max m K α m(1+µ) µ] τ)) = Q( γ ([min α max m K α m(1+µ) µ] τ)) = Q( γ ([ 1 K (1+µ) µ] τ)). Thus, the vector α which minimizes the value of its maximum element is the uniform weight vector. This motivates the attackers use of a uniformly weighted coefficient vector α to maximize the probability that none of the members will be caught. B. Minimax error analysis From a detection standpoint, an important criterion is the minimax error probability (11). The threshold τ trades off type I and type II errors. Thus, there is a value of τ, denoted by τ, which minimizes the maximum of the probabilities of the two error types. Since the bound for the type I error probability is independent of α, and the bound for the type II error probability is maximized with a uniform weighting, assume this to be the case. Theorem 8. The minmax probability of error (11) can be bounded as: ) ( d Q( low d ) up P minmax (F,α) Q, (5) where M M 1 NDf d low := K(K 1) d NDf ( ) up := 1 (K 1)µ. K Note that for orthogonal and simplex fingerprints, the minmax errors are both of the form ( d ) (K) P minmax (F,α) = Q. For orthogonal fingerprints [0], d NDf (K) = K,

8 8 which is better than d low (K) (the Q function is decreasing). For simplex fingerprints, d (K) is slightly better than both [0]: d (K) = NDf K M M 1. Proof: The lower bound is the sphere packing lower bound [4]. For the upper bound, P e (F,τ,α) = max{p I (F,τ,α),P II (F,τ,α)} max{q( γ (τ µ)),q(γ ([ 1 K (1+µ) µ] τ))}. Since the test statistic T z (m) is normally distributed with the same variance under either of the hypotheses H 0 (m) and H 1 (m), the value of τ that minimizes this upper bound is the average of the means µ and 1+µ K µ, namely τ := 1+µ K. Using this τ and recalling (), we have P minmax (F,α) = minp e (F,τ,α) = P e (F,τ,α) τ ( γ ( Q τ µ )) ( NDf ( ) ) = Q 1 (K 1)µ K = Q(d up(k)/). Consider the regime where N is large, M grows linearly or faster than N, and WNR is constant (in particular 0, so D f = ). Then µ 1/ N, d low N K, and d up N K ( 1 K ) N = N K. If K N, then both bounds go to infinity so P minmax (F,α) 0. Also, the geometric figure of merit (1) then behaves as dist(g (K) m, G (K) m ) 1 K Nd up. If K is proportional to N, then P minmax (F,α) is bounded away from 0. We can also compute the error exponent for this test: e(f,τ 1,α) := lim N N lnp e(f,τ,α). Corollary 9. If M N K, then the error exponent is e(f,τ,α) = 1 8K. (6) Proof: The proof follows by applying the asymptotic equality lnq(t) t as t to the bounds in (5). The bounds are asymptotically equivalent. Note that this error exponent is the same as in the simplex case [0]. As K, the error exponent (6) goes to zero. V. SIMULATIONS In Section IV, the worst-case error probabilities were analyzed, where the worst case was over all collusions. Here we investigate average case behavior. We examine the probability of detecting at least one guilty user, P d (9), as a function of K with the false-alarm P fa (7) fixed below a threshold. The threshold can be interpreted as the (legally) allowable limit for probability of false accusation. We compare the average case performance of ETF fingerprints, simplex fingerprints [0], and orthogonal fingerprints [16] for four signal dimension sizes N {195, 651, 667, 818}. We also examine the performance of randomly generated ETF fingerprints for N {195, 651, 667}. The results demonstrate that ETF fingerprints perform almost as well as both orthogonal and simplex fingerprints, while accommodating several times as many users. The results also show that randomly generated ETF fingerprints do not outperform the deterministic ETF fingerprints. We now describe the design of the simulations. A. Design For each signal dimension size N, ETF, orthogonal, and simplex fingerprints were created. The deterministic ETF fingerprint design was constructed using the method shown in Example 1. For N = 195, a (,7,91)-Steiner system was used [49], yielding M = 1456 fingerprints. For N = 651 and N = 667, the Steiner systems were constructed using projective geometry, with M = 016 and M = 818 respectively [46]. For N = 818, a (,, 7 )-Steiner system was used, giving M = 16,384 fingerprints [46]. The orthogonal fingerprint design was constructed using an identity matrix. As discussed at the end of Section III, random rotations of the basis vectors can be applied in practice to hide them from attackers [16], but this does not affect detection. For orthogonal fingerprint designs, M = N. The simplex fingerprint design was constructed using the following method. The vectors of a regular simplex are equidistant from the center, having the same power, and have inner products equal to 1 N [50]. Sequentially set the elements in each fingerprint to satisfy constraints. For the first fingerprint, set the first coordinate to satisfy the power constraint (e.g. γ) and the rest of the entries as zero. To meet the inner product constraint with the first fingerprint, every remaining fingerprint has the same value as its first coordinate (e.g. 1 γn ). For the second fingerprint, set its second coordinate to meet the power constraint and the rest to be zero. Every remaining fingerprint must now have the same second coordinate to satisfy the inner product constraint with the second fingerprint. Repeating this process fills the fingerprint matrix. For simplex fingerprint designs, M = N +1. For N {195, 651, 667}, we also generated random ETF fingerprint ensembles with the same size N M as the corresponding deterministic ETF. The random fingerprints were constructed by drawing i.i.d. samples from a N(0,1/N) distribution for each element and then normalizing the fingerprints. For N {195,651,667}, 000, 50, and 30 such fingerprint ensembles were created respectively.

9 9 (a) The plot for N = 195. The number of fingerprints M used were 195 for the orthogonal, 196 for the simplex, and 1456 for the ETF constructions. There were,000 random ETF ensembles generated. (b) The plot for N = 651. The number of fingerprints M used were 651 for the orthogonal, 65 for the simplex, and 016 for the ETF constructions. There were 50 random ETF ensembles generated. (c) The plot for N = 667. The number of fingerprints M used were 667 for the orthogonal, 668 for the simplex, and 818 for the ETF constructions. There were 30 random ETF ensembles generated. (d) The plot for N = 818. The number of fingerprints M used were 818 for the orthogonal, 819 for the simplex, and 16,384 for the ETF constructions. Fig. 3. A plot of the probability of detecting at least one colluder (P d ) as a function of the number of colluders (K). The threshold τ is picked to be the minimum threshold to fix P fa The WNR is 0 db. For the curves plotting performance of random fingerprints, the curve denotes probability of detection averaged over the random fingerprint ensembles, and the vertical bars denote maximum and minimum detection probabilities. For each fingerprint matrix and collusion size K, over 15,000 linear collusion attacks were simulated. For each attack, K of the M fingerprints were randomly chosen and uniformly averaged. Next, an i.i.d. Gaussian noise vector was added with per-sample noise power = D f, corresponding to a WNR (4) of 0 db [19]. The test statistic T z (m) (5) was then computed for each user m. For each threshold τ, it was determined whether there was a detection event (at least one colluder with T z (m) > τ) and/or a false alarm (at least one innocent user with T z (m) > τ). The detection and false alarm counts were then averaged over all attacks. The minimal τ value was selected for which P fa This induced the corresponding P d. B. Results We ran experiments with four different signal dimension sizes N {195,651,667,818}. The noise level was kept at WNR = 0 db. The value of K varied between 1 and sufficiently large values so P d approached zero. Plots for the probability of detection P d as a function of the size of the coalition K are shown in Figures 3a 3d for N {195, 651, 667, 818} respectively. The largest values of K for which at least one attacker can be caught with probability (nearly) one under the P fa constraint are about, 5, 11, and 1 respectively. Overall, ETF fingerprints perform comparably to orthogonal and simplex fingerprints while accommodating many more users. Also, the randomly generated fingerprints generally performed slightly worse than the deterministic ETF

10 10 fingerprints, demonstrating that random constructions do not have an advantage in terms of focused detection. ACKNOWLEDGMENT The authors would like to thank the anonymous reviewers and the associate editor for their suggestions which improved the quality of this work. REFERENCES [1] D. Boneh and J. Shaw, Collusion-secure fingerprinting for digital data, Information Theory, IEEE Transactions on, vol. 44, no. 5, pp , [] B. Chor, A. Fiat, M. Naor, and B. Pinkas, Tracing traitors, Information Theory, IEEE Transactions on, vol. 46, no. 3, pp , 000. [3] H. Schaathun, The Boneh-Shaw fingerprinting scheme is better than we thought, Information Forensics and Security, IEEE Transactions on, vol. 1, no., pp , 006. [4] G. Tardos, Optimal probabilistic fingerprint codes, Journal of the ACM (JACM), vol. 55, no., p. 10, 008. [5] A. Somekh-Baruch and N. Merhav, On the capacity game of private fingerprinting systems under collusion attacks, Information Theory, IEEE Transactions on, vol. 51, no. 3, pp , 005. [6], Achievable error exponents for the private fingerprinting game, Information Theory, IEEE Transactions on, vol. 53, no. 5, pp , 007. [7] N. Anthapadmanabhan, A. Barg, and I. Dumer, On the fingerprinting capacity under the marking assumption, Information Theory, IEEE Transactions on, vol. 54, no. 6, pp , 008. [8] P. Moulin, Universal fingerprinting: Capacity and random-coding exponents, Arxiv preprint arxiv: , 008. [9] A. Barg, G. Blakley, G. Kabatiansky, and C. Tavernier Robust parentidentifying codes, Information Theory Workshop (ITW), 010 IEEE, pp. 1 4, 010. [10] S. Lin, M. Shahmohammadi, and H. El Gamal, Fingerprinting with minimum distance decoding, Information Forensics and Security, IEEE Transactions on, vol. 4, no. 1, pp , 009. [11] M. Cheng and Y. Miao, On anti-collusion codes and detection algorithms for multimedia fingerprinting, Information Theory, IEEE Transactions on, vol. 57, no. 7, pp , 011. [1] J. Cotrina-Navau and M. Fernández, A family of asymptotically good binary fingerprinting codes, Information Theory, IEEE Transactions on, vol. 56, no. 10, pp , 010. [13] D. Boneh, A. Kiayias, and H. Montgomery, Robust fingerprinting codes: a near optimal construction, in Proceedings of the tenth annual ACM workshop on Digital rights management. ACM, 010, pp [14] H. Koga and Y. Minami, A digital fingerprinting code based on a projective plane and its identifiability of all malicious users, IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences, vol. 94, no. 1, pp. 3 3, 011. [15] W. Trappe, M. Wu, Z. Wang, and K. Liu, Anti-collusion fingerprinting for multimedia, Signal Processing, IEEE Transactions on, vol. 51, no. 4, pp , 003. [16] I. Cox, J. Kilian, F. Leighton, and T. Shamoon, Secure spread spectrum watermarking for multimedia, Image Processing, IEEE Transactions on, vol. 6, no. 1, pp , [17] J. Kilian, F. Leighton, L. Matheson, T. Shamoon, R. Tarjan, and F. Zane, Resistance of digital watermarks to collusive attacks, in IEEE International Symposium on Information Theory, 1998, pp [18] F. Ergun, J. Kilian, and R. Kumar, A note on the limits of collusionresistant watermarks, in Advances in Cryptology, EUROCRYPT 99. Springer, 1999, pp [19] Z. Wang, M. Wu, H. Zhao, W. Trappe, and K. Liu, Anti-collusion forensics of multimedia fingerprinting using orthogonal modulation, Image Processing, IEEE Transactions on, vol. 14, no. 6, pp , 005. [0] N. Kiyavash, P. Moulin, and T. Kalker, Regular simplex fingerprints and their optimality properties, Information Forensics and Security, IEEE Transactions on, vol. 4, no. 3, pp , Sept [1] N. Hayashi, M. Kuribayashi, and M. Morii, Collusion-resistant fingerprinting scheme based on the cdma-technique, in Proceedings of the Security nd international conference on Advances in information and computer security. Springer-Verlag, 007, pp [] Z. Li and W. Trappe, Collusion-resistant fingerprints from wbe sequence sets, in Communications, 005. ICC IEEE International Conference on, vol.. IEEE, 005, pp [3] J. Jourdas and P. Moulin, High-rate random-like spherical fingerprinting codes with linear decoding complexity, Information Forensics and Security, IEEE Transactions on, vol. 4, no. 4, pp , 009. [4] N. Kiyavash and P. Moulin, Sphere packing lower bound on fingerprinting error probability, in Proceedings of SPIE, vol. 6505, 007. [5] O. Dalkilic, E. Ekrem, S. Varlik, and M. Mihcak, A detection theoretic approach to digital fingerprinting with focused receivers under uniform linear averaging Gaussian attacks, Information Forensics and Security, IEEE Transactions on, vol. 5, no. 4, pp , 010. [6] Y. Wang and P. Moulin, Capacity and optimal collusion attack channels for Gaussian fingerprinting games, vol. 6505, no. 1. SPIE, 007, p J. [7] H. Ling, H. Feng, F. Zou, W. Yan, and Z. Lu, A novel collusion attack strategy for digital fingerprinting, Digital Watermarking, pp. 4 38, 011. [8] N. Kiyavash and P. Moulin, Performance of orthogonal fingerprinting codes under worst-case noise, Information Forensics and Security, IEEE Transactions on, vol. 4, no. 3, pp , 009. [9] R. Pickholtz, D. Schilling, and L. Milstein, Theory of spread-spectrum communications a tutorial, Communications, IEEE Transactions on, vol. 30, no. 5, pp , 198. [30] I. Cox, M. Miller, and J. Bloom, Digital watermarking. Morgan Kaufmann Pub, 00. [31] F. Hartung and M. Kutter, Multimedia watermarking techniques, Proceedings of the IEEE, vol. 87, no. 7, pp , [3] W. Dai, N. Kiyavash, and O. Milenkovic, Spherical codes for sparse digital fingerprinting, in Spring Central Meeting of the American Mathematical Society, AMS08, Special Session on Algebraic Aspects of Coding Theory, 008. [33] D. Varodayan and C. Pépin, Collusion-aware traitor tracing in multimedia fingerprinting using sparse signal approximation, in Acoustics, Speech and Signal Processing, 008. ICASSP 008. IEEE International Conference on. IEEE, 008, pp [34] H. Pham, W. Dai, and O. Milenkovic, Compressive list-support recovery for colluder identification, in Acoustics Speech and Signal Processing (ICASSP), 010 IEEE International Conference on. IEEE, pp [35] C. Colbourn, D. Horsley, and V. Syrotiuk, Frameproof codes and compressive sensing, in Communication, Control, and Computing (Allerton), 48th Allerton Conference on. IEEE, 010, pp [36] E. Candes and T. Tao, Decoding by linear programming, IEEE Transactions on Information Theory, vol. 51, no. 1, pp , 005. [37] D. Needell and J.A. Tropp, Cosamp: Iterative signal recovery from incomplete and inaccurate samples, Appl. Comp. Harmonic Anal., vol. 6, pp , 008. [38] M.A. Davenport and M.B. Wakin, Analysis of Orthogonal Matching Pursuit Using the Restricted Isometry Property, IEEE Trans. Inform. Theory, vol. 56, pp , 010. [39] E. Candes, J. Romberg, and T. Tao, Stable signal recovery from incomplete and inaccurate measurements, Communications on pure and applied mathematics, vol. 59, no. 8, pp , 006. [40] A.S. Bandeira, E. Dobriban, D.G. Mixon, and W.F. Sawin, Certifying the restricted isometry property is hard, Available online: arxiv: [41] A.M. Tillmann and M.E. Pfetsch, The Computational Complexity of the Restricted Isometry Property, the Nullspace Property, and Related Concepts in Compressed Sensing, Available online: arxiv: [4] D.G. Mixon, Sparse Signal Processing with Frame Theory, Ph.D. Thesis, Princeton University, 01, Available online: arxiv: [43] L. Welch, Lower bounds on the maximum cross correlation of signals (corresp.), Information Theory, IEEE Transactions on, vol. 0, no. 3, pp , [44] T. Strohmer and R. W. Heath, Grassmannian frames with applications to coding and communication, Applied and Computational Harmonic Analysis, vol. 14, no. 3, pp , 003. [45] R. DeVore, Deterministic constructions of compressed sensing matrices, Journal of Complexity, vol. 3, no. 4-6, pp , 007. [46] M. Fickus, D.G. Mixon, and J. Tremain, Steiner equiangular tight frames, Linear Algebra Appl., vol. 436, no. 5, pp , 01. [47] A.S. Bandeira, M. Fickus, D.G. Mixon, and P. Wong, The road to deterministic matrices with the restricted isometry property, Available online: arxiv:10.134

11 11 [48] J. van Lint and R. Wilson, A course in combinatorics, nd ed. Cambridge University Press, 001. [49] Steiner systems, in La Jolla Covering Repository, 011, ccrwest.org/cover/steiner.html. [50] J. Munkres, Elements of algebraic topology. Addison-Wesley Reading, MA, 1984, vol.. Dustin G. Mixon received the B.S. degree in mathematics from Central Washington University, Ellensburg, WA, in 004, the M.S. degree in applied mathematics from the Air Force Institute of Technology, Wright-Patterson AFB, OH, in 006, and the Ph.D. degree in applied and computational mathematics from Princeton University, Princeton, NJ, in 01. From 006 to 009, he was an applied mathematical analyst at the Air Force Research Laboratory, Brooks City-Base, TX. He is presently an Assistant Professor of Mathematics in the Department of Mathematics and Statistics at the Air Force Institute of Technology. His research interests include frame theory, signal processing, and compressed sensing. Negar Kiyavash received the B.S. degree in electrical and computer engineering from the Sharif University of Technology, Tehran, in 1999, and the M.S. and Ph.D. degrees, also in electrical and computer engineering, both from the University of Illinois at Urbana-Champaign in 003 and 006, respectively. She is presently an Assistant Professor in the Electrical and Computer Engineering Department at the University of Illinois at Urbana-Champaign. Her research interests are in information theory and statistical signal processing with applications to computer, communication, and multimedia security. Matthew Fickus received a Ph.D. in Mathematics from the University of Maryland in 001, and spent the following three years at Cornell University as an NSF VIGRE postdoc. In 004, he started working in the Department of Mathematics and Statistics of the Air Force Institute of Technology, where he is currently an Associate Professor of Mathematics. His research focuses on frames and harmonic analysis, emphasizing their applications to signal and image processing. Christopher J. Quinn recieved a B.S. in Engineering Physics from Cornell University and M.S. in Electrical and Computer Engineering from the University of Illinois at Urbana-Champaign in 008 and 010 respectively. He is currently a Ph.D. student in Electrical and Computer Engineering at the University of Illinois at Urbana-Champaign. His research interests include information theory and statistical signal processing.